17059 matches found
CVE-2026-20796 Time-of-check time-of-use vulnerability in common teams API
Mattermost versions 10.11.x = 10.11.9 fail to properly validate channel membership at the time of data retrieval which allows a deactivated user to learn team names they should not have access to via a race condition in the /commonteams API endpoint.. Mattermost Advisory ID: MMSA-2025-00549...
CVE-2026-20796 Time-of-check time-of-use vulnerability in common teams API
Mattermost versions 10.11.x = 10.11.9 fail to properly validate channel membership at the time of data retrieval which allows a deactivated user to learn team names they should not have access to via a race condition in the /commonteams API endpoint.. Mattermost Advisory ID: MMSA-2025-00549...
PT-2026-25813
Name of the Vulnerable Software and Affected Versions Mattermost versions 10.11.0 through 10.11.10 Description Mattermost versions 10.11.x up to and including 10.11.10 do not correctly validate permission requirements in the team member roles API endpoint. This allows team administrators to demot...
PT-2026-25684
Name of the Vulnerable Software and Affected Versions Mattermost versions 10.11.x through 10.11.10 Mattermost versions 11.2.x through 11.2.2 Mattermost versions 11.3.x through 11.3.0 Description The software does not correctly check team membership when searching for channels. This allows a team...
PT-2026-25679
Name of the Vulnerable Software and Affected Versions Mattermost versions 10.11.0 through 10.11.10 Mattermost versions 11.2.0 through 11.2.2 Mattermost versions 11.3.0 Description Mattermost does not properly filter invite IDs based on user permissions. This allows regular users to bypass access...
VulnCheck KEV: CVE-2015-5471
Absolute path traversal vulnerability in include/user/download.php in the Swim Team plugin 1.44.10777 for WordPress allows remote attackers to read arbitrary files via a full pathname in the file parameter...
VOID
VOID ██╗ ██╗ ██████╗ ██╗██████╗ ██║ ██║██╔═══██╗██║█...
iPhone Lockdown Mode Protects Washington Post Reporter
404Media is reporting that the FBI could not access a reporter's iPhone because it had Lockdown Mode enabled: The court record shows what devices and data the FBI was able to ultimately access, and which devices it could not, after raiding the home of the reporter, Hannah Natanson, in January as...
Exploit for CVE-2025-66478
Vulnerable Mall Next.js Red/Blue Team Training Target Vul...
Top AI Tools for Red Teaming in 2026
Red teaming has undergone a radical evolution. Modern organizations can no longer rely solely on human creativity or…...
WordPress Elementor Addons by Livemesh plugin <= 8.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Members Widget vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via Team Members Widget vulnerability discovered by Nikolas - mdr in WordPress Plugin Livemesh Addons for Elementor versions = 8.3.4...
WordPress Beaver Builder Addons by WPZOOM plugin <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Members Widget vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via Team Members Widget vulnerability discovered by Francesco Carlucci in WordPress Plugin Beaver Builder Addons by WPZOOM versions = 1.3.4...
WordPress The Plus Addons for Elementor plugin <= 5.4.1 - Authenticated (Contributor+) Local File Inclusion via Team Member Listing vulnerability
Authenticated Contributor+ Local File Inclusion via Team Member Listing vulnerability discovered by wesley wcraft in WordPress Plugin The Plus Addons for Elementor Page Builder Lite versions = 5.4.1...
WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 1.5.112 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'email' vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via 'email' vulnerability discovered by shaman0x01 - Shaman Red Team in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions = 1.5.112...
nightfury
NightFury Framework Version 2.0 | Professional Red Team Ope...
CISA: Assembling a Multi-Disciplinary Insider Threat Management Team
In CISA's continuing work to strengthen infrastructure security, the Assembling a Multi-Disciplinary Insider Threat Management Team infographic aims to enhance the awareness of critical infrastructure stakeholders regarding insider threats, the potential damage they can inflict, and the steps...
CVE-2026-23566 Log Injection in Content Distribution Service UDP Handler
A vulnerability in TeamViewer DEX Client former 1E Client - Content Distribution Service NomadBranch.exe prior version 26.1 for Windows allows an attacker on the adjacent network to inject, tamper with, or forge log entries in \Nomad Branch.log via crafted data sent to the UDP network handler. Th...
The vulnerability of the API Team Manager web hosting cPanel control interface allows a hacker to upload arbitrary files and increase their privileges.
The API Team Manager web hosting control panel has a vulnerability due to incorrect path name restrictions for the restricted directory. Exploiting this vulnerability allows an attacker to write arbitrary files and elevate their privileges to the root level...
